Package org.springframework.security.config.annotation

Class AbstractConfiguredSecurityBuilder<O,B extends SecurityBuilder<O>>

java.lang.Object

org.springframework.security.config.annotation.AbstractSecurityBuilder<O>

org.springframework.security.config.annotation.AbstractConfiguredSecurityBuilder<O,B>

Type Parameters:

O - The object that this builder returns

B - The type of this builder (that is returned by the base class)

All Implemented Interfaces:

SecurityBuilder<O>

Direct Known Subclasses:

AuthenticationManagerBuilder, HttpSecurity, WebSecurity

public abstract class AbstractConfiguredSecurityBuilder<O,B extends SecurityBuilder<O>>
extends AbstractSecurityBuilder<O>

A base SecurityBuilder that allows SecurityConfigurer to be applied to it. This makes modifying the SecurityBuilder a strategy that can be customized and broken up into a number of SecurityConfigurer objects that have more specific goals than that of the SecurityBuilder.

For example, a SecurityBuilder may build an DelegatingFilterProxy, but a SecurityConfigurer might populate the SecurityBuilder with the filters necessary for session management, form based login, authorization, etc.

See Also:

• WebSecurity

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	AbstractConfiguredSecurityBuilder(ObjectPostProcessor<Object> objectPostProcessor)	Creates a new instance with the provided ObjectPostProcessor.
protected	AbstractConfiguredSecurityBuilder(ObjectPostProcessor<Object> objectPostProcessor, boolean allowConfigurersOfSameType)	Creates a new instance with the provided ObjectPostProcessor.

Method Summary

Modifier and Type	Method	Description
<C extends SecurityConfigurerAdapter<O, B>> C	apply(C configurer)	Deprecated, for removal: This API element is subject to removal in a future version. For removal in 7.0.
protected void	beforeConfigure()	Invoked prior to invoking each SecurityConfigurer.configure(SecurityBuilder) method.
protected void	beforeInit()	Invoked prior to invoking each SecurityConfigurer.init(SecurityBuilder) method.
protected final O	doBuild()	Executes the build using the SecurityConfigurer's that have been applied using the following steps: Invokes beforeInit() for any subclass to hook into Invokes SecurityConfigurer.init(SecurityBuilder) for any SecurityConfigurer that was applied to this builder. Invokes beforeConfigure() for any subclass to hook into Invokes performBuild() which actually builds the Object
<C extends SecurityConfigurer<O, B>> C	getConfigurer(Class<C> clazz)	Gets the SecurityConfigurer by its class name or null if not found.
<C extends SecurityConfigurer<O, B>> List<C>	getConfigurers(Class<C> clazz)	Gets all the SecurityConfigurer instances by its class name or an empty List if not found.
O	getOrBuild()	Similar to AbstractSecurityBuilder.build() and AbstractSecurityBuilder.getObject() but checks the state to determine if AbstractSecurityBuilder.build() needs to be called first.
<C> C	getSharedObject(Class<C> sharedType)	Gets a shared Object.
Map<Class<?>,Object>	getSharedObjects()	Gets the shared objects
B	objectPostProcessor(ObjectPostProcessor<Object> objectPostProcessor)	Specifies the ObjectPostProcessor to use.
protected abstract O	performBuild()	Subclasses must implement this method to build the object that is being returned.
protected <P> P	postProcess(P object)	Performs post processing of an object.
<C extends SecurityConfigurer<O, B>> C	removeConfigurer(Class<C> clazz)	Removes and returns the SecurityConfigurer by its class name or null if not found.
<C extends SecurityConfigurer<O, B>> List<C>	removeConfigurers(Class<C> clazz)	Removes all the SecurityConfigurer instances by its class name or an empty List if not found.
<C> void	setSharedObject(Class<C> sharedType, C object)	Sets an object that is shared by multiple SecurityConfigurer.
<C extends SecurityConfigurerAdapter<O, B>> B	with(C configurer, Customizer<C> customizer)	Applies a SecurityConfigurerAdapter to this SecurityBuilder and invokes SecurityConfigurerAdapter.setBuilder(SecurityBuilder).

Methods inherited from class org.springframework.security.config.annotation.AbstractSecurityBuilder

build, getObject

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

AbstractConfiguredSecurityBuilder

protected AbstractConfiguredSecurityBuilder(ObjectPostProcessor<Object> objectPostProcessor)

Creates a new instance with the provided ObjectPostProcessor. This post processor must support Object since there are many types of objects that may be post processed.

Parameters:

objectPostProcessor - the ObjectPostProcessor to use

AbstractConfiguredSecurityBuilder

protected AbstractConfiguredSecurityBuilder(ObjectPostProcessor<Object> objectPostProcessor,
 boolean allowConfigurersOfSameType)

Creates a new instance with the provided ObjectPostProcessor. This post processor must support Object since there are many types of objects that may be post processed.

Parameters:

objectPostProcessor - the ObjectPostProcessor to use

allowConfigurersOfSameType - if true, will not override other SecurityConfigurer's when performing apply

Method Details

getOrBuild

public O getOrBuild()

Similar to AbstractSecurityBuilder.build() and AbstractSecurityBuilder.getObject() but checks the state to determine if AbstractSecurityBuilder.build() needs to be called first.

Returns:

the result of AbstractSecurityBuilder.build() or AbstractSecurityBuilder.getObject(). If an error occurs while building, returns null.

apply

@Deprecated(since="6.2",
            forRemoval=true)
public <C extends SecurityConfigurerAdapter<O,
B>> C apply(C configurer)
                                                   throws Exception

Deprecated, for removal: This API element is subject to removal in a future version.

For removal in 7.0. Use with(SecurityConfigurerAdapter, Customizer) instead.

Applies a SecurityConfigurerAdapter to this SecurityBuilder and invokes SecurityConfigurerAdapter.setBuilder(SecurityBuilder).

Parameters:

configurer -

Returns:

the SecurityConfigurerAdapter for further customizations

Throws:

Exception

apply

public <C extends SecurityConfigurer<O,
B>> C apply(C configurer)
                                            throws Exception

Applies a SecurityConfigurer to this SecurityBuilder overriding any SecurityConfigurer of the exact same class. Note that object hierarchies are not considered.

Parameters:

configurer -

Returns:

the SecurityConfigurerAdapter for further customizations

Throws:

Exception

with

public <C extends SecurityConfigurerAdapter<O,
B>> B with(C configurer,
 Customizer<C> customizer)
                                                  throws Exception

Applies a SecurityConfigurerAdapter to this SecurityBuilder and invokes SecurityConfigurerAdapter.setBuilder(SecurityBuilder).

Parameters:

configurer -

Returns:

the SecurityBuilder for further customizations

Throws:

Exception

Since:

6.2

setSharedObject

public <C> void setSharedObject(Class<C> sharedType,
 C object)

Sets an object that is shared by multiple SecurityConfigurer.

Parameters:

sharedType - the Class to key the shared object by.

object - the Object to store

getSharedObject

public <C> C getSharedObject(Class<C> sharedType)

Gets a shared Object. Note that object heirarchies are not considered.

Parameters:

sharedType - the type of the shared Object

Returns:

the shared Object or null if it is not found

getSharedObjects

public Map<Class<?>,Object> getSharedObjects()

Gets the shared objects

Returns:

the shared Objects

getConfigurers

public <C extends SecurityConfigurer<O,
B>> List<C> getConfigurers(Class<C> clazz)

Gets all the SecurityConfigurer instances by its class name or an empty List if not found. Note that object hierarchies are not considered.

Parameters:

clazz - the SecurityConfigurer class to look for

Returns:

a list of SecurityConfigurers for further customization

removeConfigurers

public <C extends SecurityConfigurer<O,
B>> List<C> removeConfigurers(Class<C> clazz)

Removes all the SecurityConfigurer instances by its class name or an empty List if not found. Note that object hierarchies are not considered.

Parameters:

clazz - the SecurityConfigurer class to look for

Returns:

a list of SecurityConfigurers for further customization

getConfigurer

public <C extends SecurityConfigurer<O,
B>> C getConfigurer(Class<C> clazz)

Gets the SecurityConfigurer by its class name or null if not found. Note that object hierarchies are not considered.

Parameters:

clazz -

Returns:

the SecurityConfigurer for further customizations

removeConfigurer

public <C extends SecurityConfigurer<O,
B>> C removeConfigurer(Class<C> clazz)

Removes and returns the SecurityConfigurer by its class name or null if not found. Note that object hierarchies are not considered.

Parameters:

clazz -

Returns:

objectPostProcessor

public B objectPostProcessor(ObjectPostProcessor<Object> objectPostProcessor)

Specifies the ObjectPostProcessor to use.

Parameters:

objectPostProcessor - the ObjectPostProcessor to use. Cannot be null

Returns:

the SecurityBuilder for further customizations

postProcess

protected <P> P postProcess(P object)

Performs post processing of an object. The default is to delegate to the ObjectPostProcessor.

Parameters:

object - the Object to post process

Returns:

the possibly modified Object to use

doBuild

protected final O doBuild()
                   throws Exception

Executes the build using the SecurityConfigurer's that have been applied using the following steps:

• Invokes beforeInit() for any subclass to hook into
• Invokes SecurityConfigurer.init(SecurityBuilder) for any SecurityConfigurer that was applied to this builder.
• Invokes beforeConfigure() for any subclass to hook into
• Invokes performBuild() which actually builds the Object

Specified by:

doBuild in class AbstractSecurityBuilder<O>

Returns:

the object that should be returned by AbstractSecurityBuilder.build().

Throws:

Exception - if an error occurs

beforeInit

protected void beforeInit()
                   throws Exception

Invoked prior to invoking each SecurityConfigurer.init(SecurityBuilder) method. Subclasses may override this method to hook into the lifecycle without using a SecurityConfigurer.

Throws:

Exception

beforeConfigure

protected void beforeConfigure()
                        throws Exception

Invoked prior to invoking each SecurityConfigurer.configure(SecurityBuilder) method. Subclasses may override this method to hook into the lifecycle without using a SecurityConfigurer.

Throws:

Exception

performBuild

protected abstract O performBuild()
                           throws Exception

Subclasses must implement this method to build the object that is being returned.

Returns:

the Object to be buit or null if the implementation allows it

Throws:

Exception